stand alone implementation of your RAM wipe scripts?

stand alone implementation of your RAM wipe scripts?

Answered

Need more info
Answered
Working on it

in Liberté Linux » Development • 11 months ago

I'd like to implement RAM wipe on shutdown on a standard Linux installation (FDE). To my knowledge only two such projects exist: built into Liberte and Tails. First, do you have any intention to eventually split this functionality into it's own package or upstream these improvements to Gentoo? RAM wipe would benefit a wide range of user cases, not just Tor, anonymity and live distros.

Secondly, I looked into the Liberte sources but I didn't fully grasp the concept of how to implement this feature in detail. Could you provide some high level overview of what parts are necessary and how they all work together?

Replies(1)

Maxim Kam..

Re: stand alone implementation of your RAM wipe scripts?

11 months ago

First, do you have any intention to eventually split this functionality into it's own package or upstream these improvements to Gentoo?

Yes, I intend to eventually split several projects, to be hosted on GitHub most likely, with an ebuild available:

RAM wiping
(C-language) htpdate fixes and enhancements
Language, time zone, and keyboard layout customization
OTFE volume resizing (otfe-resize)
Killing all processed of a given user (slay)
Anonymized bug reporting (bug-report)

Could you provide some high level overview of what parts are necessary and how they all work together?

Sure, it goes like this:

src/root/patches/inittab.patch patches /etc/inittab to reboot with a KEXEC kernel in final shutdown/reboot runlevels
src/etc/init.d/lockdown and /src/etc/init.d/memwipe use kexec-load to load the KEXEC kernel with different parameters (so that it knows whether to shutdown or to reboot, etc.)
src/etc/init.d/lockdown also loads poweroff-watchdog that reboots with a KEXEC kernel on abrupt boot media extraction
src/usr/local/sbin/kexec-load loads the KEXEC kernel and initramfs into RAM (/etc/init.d/kexec is not good enough for that purpose)
src/usr/local/src/init-kexec.c is the KEXEC kernel's initramfs' init executable (see src/root/initrd/initramfs-kexec)
src/root/config/linux-3.2.11-hardened-kexec{,-64}.config are the KEXEC kernel configs
src/usr/local/sbin/poweroff-watchdog is a launcher for udev-watchdog
src/usr/local/src/udev-watchdog.c watches for media extraction events, and reboots with a KEXEC kernel when a second kexec argument is supplied (so be careful when debugging)

Comment

Top Reply

Response title

Attachments

New to this Portal?